Privacy Policy

The data controller for personal data collected through this website is Luca Vallelonga, natural person, resident in Dubai (UAE).

For any request regarding your personal data, the rights you can exercise or the operation of the site, write to: privacy@lucavallelonga.com.

Data you provide voluntarily: email address (Letter from Dubai newsletter signup, Guide 2026 download), optional name and contact details (contact forms, consultancy requests, call bookings), investor profile information you enter in Your Strategy (budget, horizon, objectives, risk appetite, tax setup).

Data collected automatically: essential technical logs for site operation (anonymised IP address, request timestamps). No profiling tools or advertising trackers are active. Any privacy-friendly analytics tools will be disclosed in this policy at the time of activation.

To respond to your contact requests and provide the requested consultancy — legal basis: pre-contractual measures (art. 6(1)(b) GDPR).

To send you the Letter from Dubai newsletter and informational communications on Dubai/UAE real estate, subject to your explicit consent at subscription — legal basis: consent (art. 6(1)(a) GDPR). You can withdraw consent at any time by clicking the unsubscribe link in every email, without affecting the lawfulness of previous processing.

To comply with any legal obligations (e.g. authority requests) — legal basis: legal obligation (art. 6(1)(c) GDPR).

To ensure site security (anti-abuse, anti-spam) — legal basis: legitimate interest (art. 6(1)(f) GDPR).

To deliver our services we rely on the following providers who process data on our behalf as data processors, each with their own privacy notice on their official website:

• Cloudflare, Inc. (USA) — site hosting infrastructure, storage (KV, R2), CDN. Adheres to the EU-U.S. Data Privacy Framework.

• Resend, Inc. (USA) — transactional email (subscription confirmation, system notifications) and newsletter broadcasts. Adheres to the EU-U.S. Data Privacy Framework.

• Telegram FZ-LLC (UAE) — internal notification bot that sends alerts to Luca Vallelonga about new leads, articles and other system activities; personal data of site users is not sent via Telegram, only aggregated references and technical identifiers.

Your data is neither shared nor sold to third parties for the marketing purposes of parties other than the controller.

The controller operates from Dubai (United Arab Emirates), therefore your personal data, once provided, is also processed outside the European Economic Area. By subscribing to the newsletter, sending a message via contact forms or using Your Strategy, you give explicit consent to such transfer (art. 49(1)(a) GDPR).

The providers listed above are mostly established in the United States: Cloudflare and Resend both adhere to the EU-U.S. Data Privacy Framework, ensuring an adequate level of protection recognised by the European Commission.

An adequacy decision by the European Commission is not in place for the United Arab Emirates. The controller takes reasonable measures to protect data in compliance with the GDPR; in absence of your explicit consent at signup, no further processing takes place.

Newsletter subscribers: data is retained until consent is withdrawn ("unsubscribe" click in every email) or until your explicit deletion request.

Leads and contact requests: data is retained for the time necessary to handle the request and, subsequently, for a period not exceeding 24 months for commercial follow-up purposes, unless you object.

Technical logs: retained for a maximum of 90 days for security and debugging purposes.

You may at any time exercise the following rights under articles 15-22 of the GDPR:

• Right of access (know what data we hold about you)

• Right of rectification (correct inaccurate data)

• Right to erasure / to be forgotten

• Right to restriction of processing

• Right to data portability

• Right to object

• Right to withdraw consent (for processing based on consent)

To exercise your rights, write to privacy@lucavallelonga.com. The request is free of charge and we respond within 30 days.

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or another competent supervisory authority based on your residence.

This policy may be updated over time to reflect regulatory changes or changes in the services offered. The version in force is always the one published on this page, with the last-updated date indicated at the top.